GSPB: a global-statistic and packet-byte fusion framework for encrypted traffic classification

Abstract While encrypted traffic protects user privacy and data security, it is also frequently exploited by malicious actors for illegal activities, e.g., phishing and malware distribution. Therefore, accurately and efficiently identifying user behavior behind encrypted traffic is crucial to maintaining network security. However, existing encrypted traffic classification methods rely on flow-level feature extraction, which is ineffective for short traffic flow. Additionally, these methods only analyze the graph interaction structure between local clients and remote servers, failing to effectively utilize the byte-level information in packets. This results in limited adaptability and low accuracy. To address these limitations, in this paper, we propose an encrypted traffic classification method, named Global-Statistical features and Packet-Bytes, for feature extraction and fusion. This method effectively utilizes byte-level information and constructs a graph structure based on sliding windows and Jaccard similarity between packet bytes. In particular, we design a triple embedding layer to embed traffic flow features and packet byte features. Feature fusion is achieved through an encoder-decoder module and a cross-gated feature fusion mechanism. Experiments on public datasets show that our method outperforms several state-of-the-art methods in fine-grained encrypted traffic classification tasks.